Hi,

I had a question about the password protection of excel. When I go to tools
-- options-- security there are different types of encryptions. I just
chose a password to open the workbook - but does it matter what type of
encryption you use and how safe is the encryption? I don't know a lot about
encryption.

Thanks for your help.

Jeff,
I don't know a lot about encryption either. Point of fact being that I've
never intentionally encrypted so much as one MS Office document that I've
ever created.

You can pick up a lot of info on the subject by searching the web for 'RC4
encryption', since the RC4 varieties would presumably be more secure than
plain old XOR encryption. But I found one article that appears to be
reputable that points out weaknesses in the implementation of RC4 in both
Word and Excel up through 2003: http://eprint.iacr.org/2005/007.pdf

RC4 is know to be relatively weak these days. There is (not available in
the choices) RC5 available and a large effort to crack it being formally made
to determine just how secure it is.

Keep in mind that if you encrypt, you must keep up with the key/password
somehow. A strong key/password will NOT be something you can easily remember
such as your mother's maiden name combined with your pet's name spelled
backwards. This in turn implies that you have to write it down somewhere and
keep it safe. Now, if no one is around but you, it's actually fine and dandy
just to write them down on a sheet of paper and tape it to your monitor.
What you don't want to do is store them in an unencrypted file on the same
computer with the encrypted files! Remember: if you lose the key/password,
YOU lose access to the files and data in them also. Bad scenario: you have
some seriously encrypted files on your USB thumb drive in your pocket. The
key/passwords to that data is written down on a piece of paper in a locked
drawer at your office. Your office burns down.

When you try to decide on which encryption algorithm to be used, consider
the factors involved in the "why" of your perceived need to encrypt them:
How truly critical is the information in the files?
What damage could be done should the information get into the hands of the
"wrong" person/
What is the likelyhood that an unauthorized person would even have access to
the files?
What is the likelyhood that an unauthorized person having gained access to
the files will even go to the trouble of trying to decrypt them?
And ... what other systems configurations may you need to access the files
on? In looking at the options in Excel 2003, it would appear that the RC4
options would make the files unusable on versions of Excel from 2000 on back.
So if you had files that you normally work with under Excel 2003 but had to
take them to someone who has Office 2000, you may not be able to work with
them on that system at all.

One bottom line is that regardless of the level of encryption you use,
someone with enough determination, time and resources can eventually decrypt
it. In most cases where simple 'personal' files that are primarily only of
interest to you are concerned, a password being required to open the file
will suffice to keep the casual interloper out. For things actually
requiring encryption such as business trade secrets info, financial data,
access codes to financial data, personal data that could be used to steal
your identity, etc. then you may want to look into 3rd party encryption
programs or even levels of encryption (encrypt the data file, pack it into an
encrypted compression file such as a .zip or .arc) now they've got to battle
with 2 levels of encryption to get to your data ... of course you have to
take extra effort to work with the data and put it back into a protected
state.

I won't make a recommendation as to which is better because I'm really not
qualified to do that. I will say this: when given the option to choose 40bit
encryption or 128bit, go with the larger number; if nothing else it will
cause someone trying to crack into it to take more time to get in. For the
files that you just want to keep casual prying eyes out of, consider going
with a standard 'weak' encryption method that you can actually break easily
should you lose your key/password. You'll sometimes see requests here in
these forums where such a strategy actually works FOR a person: "Help, I used
a password to protect my workbook/worksheet, how can I get back into it all?"
and the answer is that there are many readily available cracking tools that
will reveal a usable password in seconds (I've got one myself).
"Jeff" wrote:

Hi,

I had a question about the password protection of excel. When I go to tools
-- options-- security there are different types of encryptions. I just
chose a password to open the workbook - but does it matter what type of
encryption you use and how safe is the encryption? I don't know a lot about
encryption.

Thanks for your help.

Wow -

Thanks for your response - you had a lot of detail + helpful things to say.

I really appreciate your help!

"JLatham" wrote:

Jeff,
I don't know a lot about encryption either. Point of fact being that I've
never intentionally encrypted so much as one MS Office document that I've
ever created.

You can pick up a lot of info on the subject by searching the web for 'RC4
encryption', since the RC4 varieties would presumably be more secure than
plain old XOR encryption. But I found one article that appears to be
reputable that points out weaknesses in the implementation of RC4 in both
Word and Excel up through 2003: http://eprint.iacr.org/2005/007.pdf

RC4 is know to be relatively weak these days. There is (not available in
the choices) RC5 available and a large effort to crack it being formally made
to determine just how secure it is.

Keep in mind that if you encrypt, you must keep up with the key/password
somehow. A strong key/password will NOT be something you can easily remember
such as your mother's maiden name combined with your pet's name spelled
backwards. This in turn implies that you have to write it down somewhere and
keep it safe. Now, if no one is around but you, it's actually fine and dandy
just to write them down on a sheet of paper and tape it to your monitor.
What you don't want to do is store them in an unencrypted file on the same
computer with the encrypted files! Remember: if you lose the key/password,
YOU lose access to the files and data in them also. Bad scenario: you have
some seriously encrypted files on your USB thumb drive in your pocket. The
key/passwords to that data is written down on a piece of paper in a locked
drawer at your office. Your office burns down.

When you try to decide on which encryption algorithm to be used, consider
the factors involved in the "why" of your perceived need to encrypt them:
How truly critical is the information in the files?
What damage could be done should the information get into the hands of the
"wrong" person/
What is the likelyhood that an unauthorized person would even have access to
the files?
What is the likelyhood that an unauthorized person having gained access to
the files will even go to the trouble of trying to decrypt them?
And ... what other systems configurations may you need to access the files
on? In looking at the options in Excel 2003, it would appear that the RC4
options would make the files unusable on versions of Excel from 2000 on back.
So if you had files that you normally work with under Excel 2003 but had to
take them to someone who has Office 2000, you may not be able to work with
them on that system at all.

One bottom line is that regardless of the level of encryption you use,
someone with enough determination, time and resources can eventually decrypt
it. In most cases where simple 'personal' files that are primarily only of
interest to you are concerned, a password being required to open the file
will suffice to keep the casual interloper out. For things actually
requiring encryption such as business trade secrets info, financial data,
access codes to financial data, personal data that could be used to steal
your identity, etc. then you may want to look into 3rd party encryption
programs or even levels of encryption (encrypt the data file, pack it into an
encrypted compression file such as a .zip or .arc) now they've got to battle
with 2 levels of encryption to get to your data ... of course you have to
take extra effort to work with the data and put it back into a protected
state.

I won't make a recommendation as to which is better because I'm really not
qualified to do that. I will say this: when given the option to choose 40bit
encryption or 128bit, go with the larger number; if nothing else it will
cause someone trying to crack into it to take more time to get in. For the
files that you just want to keep casual prying eyes out of, consider going
with a standard 'weak' encryption method that you can actually break easily
should you lose your key/password. You'll sometimes see requests here in
these forums where such a strategy actually works FOR a person: "Help, I used
a password to protect my workbook/worksheet, how can I get back into it all?"
and the answer is that there are many readily available cracking tools that
will reveal a usable password in seconds (I've got one myself).
"Jeff" wrote:

Hi,

I had a question about the password protection of excel. When I go to tools
-- options-- security there are different types of encryptions. I just
chose a password to open the workbook - but does it matter what type of
encryption you use and how safe is the encryption? I don't know a lot about
encryption.

Thanks for your help.